1. General information

Persons responsible for the protection of your personal data are Tomasz Mróz and Justyna Mróz conducting business activity under a civil law partnership named ViewPro S.C. T.MRÓZ, J.MRÓZ, located in Skoroszewska street 2B office 34, 02-495 Warszawa, National Business Registry Number (REGON): 147452308, tax ID (NIP): PL5223019335, e-mail address: info@postcard-kiosk.eu (hereinafter referred to as “Administrator”).

We make every effort to ensure that your personal data is processed in accordance with applicable law.

2. How we collect your personal data

We obtain your personal data through the voluntarily filled forms available on websites belonging to the Administrator or cookies saved in end devices.

3. How we secure your personal data

We are committed to ensuring the security of the personal data we process. For this purpose, we design our services with your safety in mind. We have implemented appropriate procedures, policies, and precautions. We conduct training in the field of data protection, confidentiality, and security.

We regularly control the implemented protection measures in terms of their adequacy for the security of personal data processed and compliance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC).

4. Do we transfer your personal data outside the European Economic Area (EEA)?

Due to agreements with external entities, the Administrator may transfer personal data outside the European Economic Area. The transfer of personal data takes place on the basis of appropriate mechanisms that guarantee the security of data processing

5. What data do we collect about you?

The administrator may collect the following data:

• e-mail address,
• name and surname,
• telephone number,
• company name,
• home address and/or delivery address,
• image (photos).

The detailed scope of data obtained for a specific purpose is each time specified on the Administrator’s website in places where such data may be filled in.

6. Use of personal data

We process your personal data for the following purposes:

• conclusion and performance of a contract for the provision of electronic services between you and the Administrator via the Internet platforms belonging to the Administrator, including ensuring the correct quality of services, 
• fulfillment of Administrator’s legal obligations, e.g. issuing and storing invoices and accounting documents, responding to complaints within the time and form required by law, 
• to review your requests, complaints, and inquiries,

• fraud detection and prevention,
• determining the legitimacy of claims, defense against claims and pursuing claims,
• after obtaining your consent – for marketing purposes, sending the newsletter, as well as for direct marketing by the Administrator,
• after obtaining your consent – for the purposes of recruitment,
• to contact you when it is justified by our legitimate interest.

7. Does the Administrator use profiling?

The administrator does not use data profiling as defined by the GDPR

8. Data retention

We store your data for a certain amount of time depending on the purpose of their use:

• for the duration of the contract, and then for a period after which the claim arising from the contract is time-barred, and in the case of pursuing claims by the Administrator or notifying the competent authorities – for the duration of such proceedings,
• performance of duties, e.g. issuing an invoice,
• in which the regulations require the storage of data, e.g. tax law,
• necessary to handle your requests, complaints, inquiries,
• in which the Administrator may suffer legal consequences of failure to perform the obligation, e.g. receive a financial penalty from state offices,
• necessary to assess payment credibility,
• having your consent, i.e. until it is withdrawn,
• until you object if the legal basis for processing is the legitimate interest of the administrator.

9. Principles we follow

We use due diligence to protect the interests of data subjects, and in particular we try to ensure that the data collected by the Administrator is:

• processed in accordance with the law, fairly and in a transparent manner,
• collected for specific, explicit and legitimate purposes and not further processed in a manner inconsistent with these purposes,
• adequate, relevant and limited to what is necessary for the purposes for which they are processed,
• correct and, if necessary, updated,
• processed in a manner ensuring adequate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organizational measures.
• stored in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the data are processed.

10. Disclosures of your personal data

We never sell the personal data collected.

We transfer your personal data to other recipients:

• when we use the services of entities cooperating with us or our subcontractors, which applies in particular to accounting offices and marketing agencies.

* In order for us to be able to provide you with the highest level of services provided, we may use the services of other companies, entrusting them with the processing of your personal data on our behalf. At the same time, we make sure that your personal data is treated as if we were processing it directly. We carefully select external entities with whom we cooperate, and we only share with them the personal data that is necessary for the performance of their services. We make sure that your personal data is safe.

when we are required by law to transfer your data to other organizations,

when it is necessary to protect the vital interests of the data subject or another individual.

11. Your legal rights

You have full control over your personal data.

You have the right to:

• access the data that we store as a data administrator,
• receive a copy of the personal data subject to processing,
• request the correction of your personal data,
• withdraw consent to the processing of personal data, if the basis for data processing is your consent, 
• object to data processing, in the event of data processing on the basis of our legitimate interest,
• restrictions on the processing of your personal data,
• transferring your personal data,
• request the deletion of your personal data, which has not been imposed on us by a legal obligation to process them, 
• to file a complaint with the President of the Personal Data Protection Office (to the address of the Personal Data Protection Office, Stawki street 2, 00-193 Warsaw).

12. Cookie mechanism on the administrator’s web pages

Cookies are small pieces of text information placed on the user’s end device in order to:

• provide the service offered by the website and ensuring the greatest possible convenience of using the website (e.g. saving and remembering settings and preferences), entering and saving certain information, automatic logging in, 
• create counters, statistics, monitoring activity and evaluating the use of the website by visitors, 
• create reports on website traffic for website operators and providing other services related to website traffic and Internet use. 

The user may reject the use of cookies by selecting the appropriate settings in the browser, however, it should be noted that in this case it may not be possible to use all the functions of the website. 

More information, including information on disabling cookies for various browsers, can be found at: http://pl.wikipedia.org/wiki/HTTP_cookie. 

The administrator uses cookies for analysis and research and audience audit, and in particular to create anonymous statistics that help to understand how visitors use the Administrator’s websites, which allows improving their structure, content and content displayed to users. 

The administrator may use Google Analytics, i.e. Google Inc. services. (“Google”). Google Analytics uses cookies to analyze how you use the website. The data obtained is transferred to a Google server in the USA and stored there.

13. Contact details

In case of any other questions or feedback regarding our policy please contact us:

• by letter to the Administrator’s address indicated in point 1 of this policy,
• by e-mail to the e-mail address indicated in point 1 of this policy.

14. Information on the processing of personal data for employees or collaborating contractors – “contacts”

The abovementioned Administrator will be the administrator of your personal data.

We will process your personal data because you are the contact person for the Administrator at our contractor or potential contractor. Therefore, we will process your data in order to:

• Contact you on current matters, including the performance of contracts between us and your employer / entity you represent, presenting offers, receiving orders, answering questions. The legal basis for data processing is our legitimate interest in the possibility of ongoing contact with our contractors (i.e. their employees / associates).
• Provide other information about the business activity and possible forms of cooperation. The legal basis for data processing is our legitimate interest in maintaining relationships with employees and associates of our contractors. 
• Defend against any claims or pursue any claims related to the contract with the entity you work for or represent, i.e. our contractor – if a dispute related to the contract arises. The legal basis for data processing is our legitimate interest in being able to defend against claims or pursue claims. 

We have received your data directly from you or from your employer / entity you represent.

We receive data from your employer / entity you represent, such as your name and surname, business telephone number and e-mail address, place of work, position or information on what type of matters you deal with.

We will process your personal data during the course of the contract between us and your employer / entity you represent, as well as during the period of limitation of claims under the contract.

Your personal data may be transferred to our subcontractors who will provide services to your employer / entity you represent and to the law firms we work with.

You have the following rights related to the processing of your personal data:

• the right to access your data and receive a copy of it, rectify (correct) your data, delete personal data, limit data processing, the right to object to the processing of your data due to a special situation, the right to transfer data; a request in this regard may be sent to the Administrator’s contact address provided above,
• the right to file a complaint to the President of the Personal Data Protection Office (to the address of the Personal Data Protection Office, Stawki street 2, 00-193 Warsaw).

15. Information on the processing of personal data of other persons contacting the Administrator (by phone, e-mail, via the contact form) and persons with whom the Administrator contacts (by phone and e-mail)

The abovementioned Administrator will be the administrator of your personal data.

We will process your personal data in order to process your inquiry based on our legitimate interest in accordance with art. 6 sec. 1 lit. f) GDPR and for marketing purposes based on your consent in accordance with art. 6 sec. 1 lit. a) GDPR.

Your personal data may be transferred to entities cooperating with us or our subcontractors.

In accordance with the GDPR you have the right to:

• access your data and receive a copy of it,
• rectify (correct) your data,
• delete personal data,
• limit data processing,
• object to the processing of your data due to a special situation,
• data portability,

* requests in the above matters can be sent to the contact address of the data administrator, provided above,

• file a complaint to the President of the Personal Data Protection Office (to the address of the Personal Data Protection Office, Stawki street 2, 00-193 Warsaw).

With regard to the personal data being processed for marketing purposes, you can withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.

Providing personal data is voluntary and is not stipulated by law.

16. Information on the processing of personal data of people subscribing to the newsletter

The processing of personal data for the purpose of delivering the newsletter is based on Art. 6 sec. 1 lit. a) GDPR.

Your personal data may be transferred to entities cooperating with us or our subcontractors.

You have the following rights related to the processing of your personal data:

• the right to access your data and receive a copy of it,
• the right to rectify (correct) your data,
• the right to delete personal data,
• the right to limit data processing,
• the right to data portability,

* requests in the above matters can be sent to the contact address of the data administrator, provided above,

• the right to file a complaint to the President of the Personal Data Protection Office (to the address of the Personal Data Protection Office, Stawki street 2, 00-193 Warsaw).

You can withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.

Providing personal data is voluntary, it does not result from any regulations, and failure to do so will result in the inability to order the newsletter.

17. Recruitment

The purpose of data processing: recruiting the Administrator’s associates.

Place of collecting personal data: website and related profiles on social media such as Facebook, LinkedIn, etc.

The legal basis for the processing of your personal data is:

• Provision of law (Article 22 [1] § 1 of the Labor Code) – with regard to the following data:
• name and surname,
• parents’ names,
• date of birth,
• place of residence (correspondence address),
• education,
• employment history.
• Your consent to the processing of the data provided in the CV and in the cover letter, if you provide us with data other than those provided for in art. 22 [1] § 1 of the Labor Code above (e.g. telephone number and e-mail address) or when you provide your personal data when applying for a cooperating position with the Administrator on a basis other than an employment contract.
• Our legitimate interest – in the scope of data collected during the interview and the results of qualification tests. We have a legitimate interest in checking your skills and abilities – we need this to assess whether you are the right person for the position for which we are recruiting.

Personal data are not transferred to other recipients.

It is possible to transfer your data to a third country in a situation where they will be processed with the use of cloud tools, the storage space of which may be located on servers located outside the EEA, or the e-mail administrator that you use when contacting the Administrator uses servers located physically outside the EEA. 

We will store your personal data until the end of recruitment for the position for which you are applying. However, if you have given separate consent to the processing of data for the purposes of future recruitment, we will store your data until the consent to its processing is withdrawn, but no longer than 5 years from the moment of its collection. 

In accordance with the GDPR, you have the right to:

• access your data and receive a copy of it,
• rectify (correct) your data,
• delete personal data,
• limit data processing,
• object to the processing of your data due to a special situation,
• data portability,

* requests in the above matters can be sent to the contact address of the data administrator, provided above,

• file a complaint to the President of the Personal Data Protection Office (to the address of the Personal Data Protection Office, Stawki street 2, 00-193 Warsaw).

You can withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.

Consent to the transfer of personal data is voluntary, however, it is necessary in order to participate in the recruitment process. Without your consent, we will not be able to take into account your application documents.

18. Processing of personal data – photos

Photos containing your image are stored on servers that are at the disposal of the Administrator, and belong to Zenbox sp.z o.o. based in Częstochowa. Photos can also be stored in the “messages sent” folder on the Zenbox account, which is at the disposal of the Administrator. 

Providing personal data, i.e. sharing your image, is voluntary, but failure to do so (i.e. not sharing your image) makes it impossible to take a photo.

19. Changes to our privacy policy

The Administrator reserves the right to change and update the Privacy Policy. Each time we make changes, we will publish a new version of the privacy policy on our website.